anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #9328] 🔒 Security Fix: CVE-2026-22812 - Make HTTP Server Authentication Mandatory #13077

New Issue
Closed
opened 2026-02-16 18:17:57 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:17:57 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/9328

State: closed
Merged: No

Summary

This PR fixes CVE-2026-22812 (CVSS 8.8), a critical remote code execution vulnerability where OpenCode's HTTP server would run without authentication if OPENCODE_SERVER_PASSWORD was not set.

Vulnerability Details

CVE-2026-22812 allows unauthenticated:

  • Shell command execution via /session/:id/shell
  • PTY hijacking via /pty
  • Arbitrary file reading via /file/content

The vulnerability was reported to support@sst.dev on 2025-11-17 with no response received. The security advisory is public: GHSA-vxw4-wv6m-9hhh

The Fix

Before (Vulnerable)

.use((c, next) => {
  const password = Flag.OPENCODE_SERVER_PASSWORD
  return basicAuth({ username, password })(c, next)
})

After (Secure)

  • Auto-generates secure 32-char password if none provided
  • Displays password prominently on startup
  • Removes authentication bypass
  • Auth is now MANDATORY for all endpoints

Security Impact

✅ Closes CVE-2026-22812 (CVSS 8.8)
✅ Prevents RCE via shell injection
✅ Blocks unauthorized file access
✅ Zero breaking changes for existing users

References

This vulnerability has been public since November 2025. Users are at risk until this is merged.

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/9328 **State:** closed **Merged:** No --- ## Summary This PR fixes **CVE-2026-22812** (CVSS 8.8), a critical remote code execution vulnerability where OpenCode's HTTP server would run without authentication if `OPENCODE_SERVER_PASSWORD` was not set. ## Vulnerability Details **CVE-2026-22812** allows unauthenticated: - Shell command execution via `/session/:id/shell` - PTY hijacking via `/pty` - Arbitrary file reading via `/file/content` The vulnerability was reported to `support@sst.dev` on **2025-11-17** with **no response received**. The security advisory is public: [GHSA-vxw4-wv6m-9hhh](https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh) ## The Fix ### Before (Vulnerable) ```typescript .use((c, next) => { const password = Flag.OPENCODE_SERVER_PASSWORD return basicAuth({ username, password })(c, next) }) ``` ### After (Secure) - Auto-generates secure 32-char password if none provided - Displays password prominently on startup - Removes authentication bypass - Auth is now MANDATORY for all endpoints ## Security Impact ✅ Closes CVE-2026-22812 (CVSS 8.8) ✅ Prevents RCE via shell injection ✅ Blocks unauthorized file access ✅ Zero breaking changes for existing users ## References - CVE: [CVE-2026-22812](https://nvd.nist.gov/vuln/detail/CVE-2026-22812) - Advisory: [GHSA-vxw4-wv6m-9hhh](https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh) **This vulnerability has been public since November 2025. Users are at risk until this is merged.**
yindo added the pull-request label 2026-02-16 18:17:57 -05:00
yindo closed this issue 2026-02-16 18:17:57 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#13077
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?